Why is the Drilldown not working?

[Shan]

When I use the below drilldown query without eval its working fine and I'm getting the result as expected. But when I add eval in the drilldown query and click on the values a new search window is opened and its empty. In the search bar, I am not able to see the query too. Option: link to search

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium"    TIER_1 !="Request"
| eval Month=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%B")
| eval Year=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%Y") 
| stats count by GROUP 

Thanks in advance.

[kamlesh_vaghela · Accepted solution]

@shankarananth,

I think you have to encode url. Can you please try below link in drilldown?

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request" | eval Month=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25B") | eval Year=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25Y") | stats count by GROUP 

Thanks

[Shan]

Thanks for your response . Yes ur right .. I need to encode .. Is there any specific link for it .. So i can go through it and complete my query . Because i need to change in many palces ..

[kamlesh_vaghela]

Hi @shankarananth,
Please use https://www.urlencoder.org/ for encoding & decoding.

Can you please accept the answer and If you got your answer? It will help community.

Happy Splunking

[Shan]

@kamlesh_vaghela -- Thank you for your help ..
Happy Splunking 🙂